Description
Vectra® is the leader in AI-driven threat detection and response for hybrid and multi-cloud enterprises.
The Vectra AI Platform delivers integrated signal across public cloud, SaaS, identity, and data center networks in a single platform. Powered by patented Attack Signal Intelligence, it empowers security teams to rapidly prioritize, investigate and respond to the most advanced cyber-attacks. With 35 patents in AI-driven threat detection and the most vendor references in MITRE D3FEND, organizations worldwide rely on the Vectra AI to move at the speed and scale of hybrid attackers. For more information, visit www.vectra.ai.
Position Overview
We are seeking an experienced Threat Detection Engineer to extend Vectra's detection capabilities across cloud and identity environments, with additional exposure to network-based threat detection.
Vectra's Attack Signal Production Group is responsible for building Vectra's core threat detection and prioritization technology, leveraging AI and other methods to alert customers to critical threats across their cloud, identity, and network environments.
Threat Detection Engineers work closely with Data Scientists who are developing AI models, and Security Researchers who are researching the threat landscape and assisting modeling efforts. This role will focus primarily on developing detections for cloud and identity attack behaviours, including threats across AWS, Azure, GCP, and identity platforms such as Microsoft Entra ID.
The ideal candidate has hands-on experience investigating cloud and identity threats using telemetry such as authentication and audit logs, CloudTrail, cloud platform logs, and network flow data. Familiarity with network threat models, protocols, and network-based telemetry is important, particularly as cloud detection increasingly incorporates data sources such as VPC and flow logs.
The role is primarily focused on cloud and identity threat detection, while providing the versatility to contribute to network detection initiatives where relevant.
Responsibilities and Accountabilities
- Research cloud and identity attack behaviours and identify opportunities for new detections.
- Develop, test, and maintain detection logic using Python and other appropriate detection technologies.
- Analyze telemetry from cloud and identity environments, including authentication activity, control-plane activity, audit logs, application logs, and network flow logs.
- Develop detections across common cloud platforms such as AWS, Azure as well as identity environments such as Microsoft Entra ID.
- Investigate malicious activity and reproduce attacker techniques to validate detection hypotheses.
- Collaborate with Data Scientists and Security Researchers to improve detection coverage and accuracy.
- Continuously assess detection effectiveness and improve detections based on real-world data.
- Stay current with emerging cloud, identity, and network attacker techniques and TTPs.
- Work with large and diverse security datasets using technologies and techniques such as Python, notebooks, SQL, Pandas, and cloud analytics platforms.
- Contribute to network threat detection where appropriate, including analysis of network protocols, flow data, PCAPs, and network attack behaviours.
Attitudes and Behaviours
- Focus on impact and results; work on the right problems and drive them through to completion.
- Demonstrate curiosity and a strong investigative mindset when working with unfamiliar attacker behaviours, telemetry, or technologies.
- Show drive and resourcefulness in overcoming technical ambiguity and incomplete information.
- Have a track record of successfully solving complex and ambiguous problems.
- Balance detection coverage with detection quality, scalability, and maintainability.
- Demonstrate high integrity and an ability to collaborate effectively across Security Research, Data Science, Engineering, and Product teams.
Qualifications and Experience
- 6+ years of cybersecurity experience, preferably focused on threat detection, security research, threat hunting, incident response, or detection engineering.
- Strong experience investigating threats in cloud and identity environments.
Similar jobs
About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to…
Truveta provides unprecedented real-world data and real-time intelligence, powered by a dataset built with and owned by US health systems united in a mission of Saving Lives with Data. Together, we power breakthrough med…
Welcome to the future of cloud networking and security! Cato Networks is the first company to converge enterprise networking and security into one centralized and global service that is delivered by cloud. It is led by n…
The Government Technology Agency (GovTech) is the lead agency driving Singapore’s Smart Nation initiatives and public sector digital transformation. As the Centre of Excellence for Infocomm Technology and Smart Systems (…
At Varicent, we’re not just transforming the Sales Performance Management (SPM) market—we’re redefining how organizations achieve revenue success. Our cutting-edge SaaS solutions empower revenue leaders globally to desig…
Truveta provides unprecedented real-world data and real-time intelligence, powered by a dataset built with and owned by US health systems united in a mission of Saving Lives with Data. Together, we power breakthrough med…
Est. 120,000 USD
Most companies claim to have the best people. We say to them, "Keep dreaming." Our people are second to none. They set us apart with their entrepreneurial spirit and ambition. They come to us from the likes of Amazon, Mi…
Truveta provides unprecedented real-world data and real-time intelligence, powered by a dataset built with and owned by US health systems united in a mission of Saving Lives with Data. Together, we power breakthrough med…
Why Valtech? We’re the experience innovation company - a trusted partner to the world’s most recognized brands. To our people we offer growth opportunities, a values-driven culture, international careers and the chance t…
Est. 840,000 SEK
Vectra® is the leader in AI-driven threat detection and response for hybrid and multi-cloud enterprises. The Vectra AI Platform delivers integrated signal across public cloud, SaaS, identity, and data center networks in…
Truveta provides unprecedented real-world data and real-time intelligence, powered by a dataset built with and owned by US health systems united in a mission of Saving Lives with Data. Together, we power breakthrough med…
Est. 140,000 USD
The Nuclear Company is the fastest growing AI tech-enabled startup in the nuclear and energy space, pioneering a fleet-scale approach to building the next generation of nuclear reactors. Through our design-once, build-ma…
Est. 165,000 USD
Vectra® is the leader in AI-driven threat detection and response for hybrid and multi-cloud enterprises. The Vectra AI Platform delivers integrated signal across public cloud, SaaS, identity, and data center networks in…
Est. 140,000 USD
Are you ready to make an impact?West Monroe is seeking a Senior Cybersecurity Architect, Agentic SOC Modernization & AI-Enabled Security Operations to join our Cybersecurity & Enterprise Technology practice. This…
Est. 160,000 USD
Who is Trace3? Trace3 is a leading Transformative IT Authority, providing unique technology solutions and consulting services to our clients. Equipped with elite engineering and dynamic innovation, we empower IT executiv…
About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to…
Welcome to the future of cloud networking and security! Cato Networks is the first company to converge enterprise networking and security into one centralized and global service that is delivered by cloud. It is led by n…
Est. 80,000 EUR
At Cision, we believe in empowering every individual to make an impact. Here, your voice is heard, your ideas are valued, and your unique perspective fuels our collective success. As part of our global team, you'll thriv…
SENIOR CYBERSECURITY CONSULTANT (SOC), KUALA LUMPUR WHO WE ARE S-RM is a global intelligence and cyber security consultancy. Since 2005, we’ve helped some of the most demanding clients in the world solve some of their to…
Est. 120,000 USD
About Yondr Yondr is a disruptor. We challenge convention and simplify complexity. A global developer, owner operator and service provider of data centers, we deliver complex data center capacity needs for the world’s la…
Est. 140,000 USD
Are you ready to make an impact?Security Architect – IT/OT Modernization Cybersecurity & Enterprise Technology | Energy & Utilities Focus Are you ready to help secure and modernize the infrastructure that powers…
Est. 250,000 USD
About the Role: PubMatic is seeking a Director of Information Security to lead and evolve our global security program across enterprise infrastructure, cloud platforms, products, corporate systems, and emerging AI techno…
Est. 155,000 USD
K2 is building the largest and highest-power satellites ever flown, unlocking performance levels previously out of reach across every orbit. Backed by over $1 billion in total funding from leading investors including Alt…
Est. 120,000 PLN
Welcome to the future of cloud networking and security! Cato Networks is the first company to converge enterprise networking and security into one centralized and global service that is delivered by cloud. It is led by n…
Est. 90,000 EUR
Welcome to the future of cloud networking and security! Cato Networks is the first company to converge enterprise networking and security into one centralized and global service that is delivered by cloud. It is led by n…
Est. 124,000 USD
Lead DevOps Engineer The Team: Information processing and sense-making systems are the lifeblood of national security efforts, facilitating an understanding of the global situation, strategic planning, and tactical execu…
Est. 65,000 GBP
CHAOS Industries is redefining modern defense with a multi-product portfolio that gives the ultimate advantage—domain dominance. The company's products are powered by Coherent Distributed Networks (CDN™), empowering warf…
Est. 124,000 USD
Lead DevOps Engineer The Team: Information processing and sense-making systems are the lifeblood of national security efforts, facilitating an understanding of the global situation, strategic planning, and tactical execu…
Est. 124,000 USD
Lead DevOps Engineer The Team: Information processing and sense-making systems are the lifeblood of national security efforts, facilitating an understanding of the global situation, strategic planning, and tactical execu…
Est. 124,000 USD
Lead DevOps Engineer The Team: Information processing and sense-making systems are the lifeblood of national security efforts, facilitating an understanding of the global situation, strategic planning, and tactical execu…